# Firewall and FastDL

> Let users allow or block IP addresses per server port with iptables rules managed by FeatherWings, and serve game files over HTTP with FastDL and nginx.

Source: https://featherpanel.com/docs/wings/firewall-and-fastdl/

Both features are off for users until an administrator turns them on in Settings, Servers:

| Setting | Default | Turns on |
|---------|---------|----------|
| Allow users to create and manage their own server firewall rules (`server_allow_user_made_firewall`) | off | The Firewall page of a server |
| Allow users to create and manage their own FastDL configurations (`server_allow_user_made_fastdl`) | off | The FastDL page of a server |

The node must run FeatherWings (both are FeatherWings features).

## Server firewall

On a server's Firewall page, users with `firewall.read` see the rules and users with `firewall.manage` can add, edit
and delete them. A rule has:

| Field | Values |
|-------|--------|
| Allocation | One of the server's ports |
| Remote IP | An address or a CIDR range, for example `203.0.113.7` or `192.168.1.0/24` |
| Action | Allow or Block |
| Protocol | `tcp` or `udp` |
| Priority | 1 to 10000, lower numbers are checked first |

Wings stores the rules in `wings.db` and writes them to the `PREROUTING` chain of the iptables `raw` table. That table
sees the packet before Docker rewrites the destination port, so a rule matches the port players connect to. Allow
becomes `ACCEPT` and Block becomes `DROP`, and rules are inserted in priority order.

```bash
sudo iptables -t raw -L PREROUTING -n --line-numbers
```

iptables rules do not survive a reboot, so Wings rebuilds all of them from `wings.db` when it starts. It also removes
rules for ports a server no longer has when the server is synced, and all rules of a server when it is deleted. The
Sync action on the page reapplies the rules of one server.

To block everyone except a few addresses, add Allow rules for those addresses with a low priority number, then a Block
rule for `0.0.0.0/0` with a higher number.

## FastDL

FastDL serves files from a server's folder over plain HTTP with nginx, so players download maps and addons from the web
server instead of the game server.

### Node setup

1. Set the FastDL port in the node's Advanced settings in the panel (default 80).
2. Install nginx on the node.
3. In `/etc/featherpanel/config.yml`, set `enabled: true` in the `fastdl` block. The configuration the panel generates
   already contains the block with the node's FastDL port and FQDN:

   ```yaml
   system:
     fastdl:
       enabled: true
       bind_port: 80
       public_hostname: node.example.com
       nginx_config_path: /etc/nginx/sites-available/featherwings-fastdl
   ```

4. Restart Wings.

When at least one server has FastDL on, Wings writes the nginx site to `nginx_config_path`, links it into
`/etc/nginx/sites-enabled/` and reloads nginx. It also adds `www-data` to the `featherpanel` group so nginx can read
the volumes. The port must not be the Wings API port. Set `public_hostname` to the node FQDN; without it Wings guesses
from the Let's Encrypt certificate path or uses a catch-all `server_name`.

The generated site uses `system.data` as its root, so a file is reachable at
`http://<node>/<server uuid>/<path>`. It refuses files ending in `.sma`, `.amxx`, `.sp`, `.smx`, `.cfg`, `.ini`, `.log`,
`.bak`, `.dat`, `.sql`, `.sq3`, `.so`, `.dll`, `.php`, `.zip`, `.rar`, `.jar` or `.sh`, and paths containing `addons`,
`cfg` or `logs`. Directory listing is on.

### Server setup

On the server's FastDL page (it needs the `settings.reinstall` permission), pick a folder inside the server, `fastdl`
by default, and click Enable FastDL. The page then shows the URL and a ready command:

```text
sv_downloadurl "http://node.example.com/<server uuid>/fastdl"
```

Put the command in `server.cfg`. The port is left out of the URL when it is 80 or when the node sits behind a reverse
proxy. The panel remembers the setting and turns FastDL back on in Wings if Wings lost it, for example after a
reinstall of the daemon.

## Frequently asked questions

### Why do my firewall rules not show up in iptables -L?

They live in the raw table. Run iptables -t raw -L PREROUTING -n --line-numbers to see them.

### Which games use FastDL?

Source engine games such as Counter-Strike, Team Fortress 2 and Garry's Mod read the sv_downloadurl variable and download maps and other content from it.